From a8be4d3d686e983468c7a8dc938017bb79dad3ab Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 19 Mar 2026 01:35:49 +0000 Subject: [PATCH] feat: add search_tools field to ObjectPermission schema and types - Add search_tools String[] column to LiteLLM_ObjectPermissionTable in all 3 Prisma schema files - Add Prisma migration for the new column - Add search_tools field to LiteLLM_ObjectPermissionBase and LiteLLM_ObjectPermissionTable Python types - Add ProxyErrorTypes for search tool access denied (key, team, org) - Add get_search_tool_access_error_type_for_object() classmethod to ProxyErrorTypes Co-authored-by: yuneng-jiang --- .../migration.sql | 2 ++ .../litellm_proxy_extras/schema.prisma | 1 + litellm/proxy/_types.py | 31 +++++++++++++++++++ litellm/proxy/schema.prisma | 1 + schema.prisma | 1 + 5 files changed, 36 insertions(+) create mode 100644 litellm-proxy-extras/litellm_proxy_extras/migrations/20260319000000_add_search_tools_to_object_permissions/migration.sql diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260319000000_add_search_tools_to_object_permissions/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260319000000_add_search_tools_to_object_permissions/migration.sql new file mode 100644 index 00000000000..1b33edc3a8b --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260319000000_add_search_tools_to_object_permissions/migration.sql @@ -0,0 +1,2 @@ +-- AlterTable +ALTER TABLE "LiteLLM_ObjectPermissionTable" ADD COLUMN "search_tools" TEXT[] DEFAULT ARRAY[]::TEXT[]; diff --git a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma index a2c83295403..084b1bdce6d 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma +++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma @@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable { mcp_access_groups String[] @default([]) mcp_tool_permissions Json? // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]} vector_stores String[] @default([]) + search_tools String[] @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege). agents String[] @default([]) agent_access_groups String[] @default([]) models String[] @default([]) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 9e86680e355..18e1ad89c72 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -856,6 +856,7 @@ class LiteLLM_ObjectPermissionBase(LiteLLMPydanticObjectBase): mcp_access_groups: Optional[List[str]] = None mcp_tool_permissions: Optional[Dict[str, List[str]]] = None vector_stores: Optional[List[str]] = None + search_tools: Optional[List[str]] = None agents: Optional[List[str]] = None agent_access_groups: Optional[List[str]] = None models: Optional[List[str]] = None @@ -1843,6 +1844,7 @@ class LiteLLM_ObjectPermissionTable(LiteLLMPydanticObjectBase): """ vector_stores: Optional[List[str]] = [] + search_tools: Optional[List[str]] = [] agents: Optional[List[str]] = [] agent_access_groups: Optional[List[str]] = [] @@ -3527,6 +3529,21 @@ class ProxyErrorTypes(str, enum.Enum): Organization does not have access to the vector store """ + key_search_tool_access_denied = "key_search_tool_access_denied" + """ + Key does not have access to the search tool + """ + + team_search_tool_access_denied = "team_search_tool_access_denied" + """ + Team does not have access to the search tool + """ + + org_search_tool_access_denied = "org_search_tool_access_denied" + """ + Organization does not have access to the search tool + """ + team_member_already_in_team = "team_member_already_in_team" """ Team member is already in team @@ -3569,6 +3586,20 @@ class ProxyErrorTypes(str, enum.Enum): elif object_type == "org": return cls.org_vector_store_access_denied + @classmethod + def get_search_tool_access_error_type_for_object( + cls, object_type: Literal["key", "team", "org"] + ) -> "ProxyErrorTypes": + """ + Get the search tool access error type for object_type + """ + if object_type == "key": + return cls.key_search_tool_access_denied + elif object_type == "team": + return cls.team_search_tool_access_denied + elif object_type == "org": + return cls.org_search_tool_access_denied + DB_CONNECTION_ERROR_TYPES = ( httpx.ConnectError, diff --git a/litellm/proxy/schema.prisma b/litellm/proxy/schema.prisma index 46be6b31e1f..e56de5d6feb 100644 --- a/litellm/proxy/schema.prisma +++ b/litellm/proxy/schema.prisma @@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable { mcp_access_groups String[] @default([]) mcp_tool_permissions Json? // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]} vector_stores String[] @default([]) + search_tools String[] @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege). agents String[] @default([]) agent_access_groups String[] @default([]) models String[] @default([]) diff --git a/schema.prisma b/schema.prisma index fde9a466a28..d5abf7ef382 100644 --- a/schema.prisma +++ b/schema.prisma @@ -269,6 +269,7 @@ model LiteLLM_ObjectPermissionTable { mcp_access_groups String[] @default([]) mcp_tool_permissions Json? // Tool-level permissions for MCP servers. Format: {"server_id": ["tool_name_1", "tool_name_2"]} vector_stores String[] @default([]) + search_tools String[] @default([]) // Search tool names allowed for this key/team/org. Empty = no access (least privilege). agents String[] @default([]) agent_access_groups String[] @default([]) models String[] @default([])